How to secure enterprise AI agents

Identity Permissions Are the Gate

Before protecting documents, determine which identity the AI agent uses. An agent may operate through:

• ✓A user’s delegated account
• ✓A managed identity
• ✓An Entra agent identity
• ✓An application registration
• ✓A platform-managed knowledge connector

This distinction matters. An agent using a developer’s account may inherit that person’s permissions, while a dedicated application identity can be restricted independently.

For SharePoint AI agents, Microsoft Graph’s Sites.Selected permission provides an important least-privilege control. It allows administrators to grant an application access to specific SharePoint sites rather than the entire tenant.

Sites.Selected requires two steps:

• ✓Add and approve the Microsoft Graph API permission.
• ✓Grant the application access to each required SharePoint site.

If either step is missed, the agent may fail—or gain broader access through another identity path.

If you cannot identify the agent at the gate, you cannot reliably control what it accesses.

Sensitivity Labels and DLP Are the Door

Access to a SharePoint site does not mean an agent should be able to read every document within it.

Microsoft Purview sensitivity labels can classify and protect individual files. For example:

• ✓Agent-readable: Approved for processing by enterprise AI agents
• ✓Agent-restricted: Must not be read or summarized by an AI agent

A label alone provides classification, not enforcement. To function as a true security control, it must apply protection such as encryption, authorized identities, or appropriate usage rights.

Microsoft Purview Data Loss Prevention (DLP) adds another layer. It can detect sensitive or labeled content, restrict actions, display policy notifications, and generate security incidents.

The gate limits where an agent can go. The door protects sensitive information after it arrives.

Audit Logs Are the Security Camera

An agent responding, “I can’t access that file,” does not prove that a security policy worked.

The failure could result from:

• ✓Missing permissions
• ✓Incomplete indexing
• ✓Expired credentials
• ✓DLP enforcement
• ✓Sensitivity-label encryption
• ✓A platform configuration problem

Microsoft Purview Audit, Activity Explorer, Entra logs, and DLP incident reports can reveal which identity attempted access and which control responded.

Enable auditing before testing AI-agent security. Without audit evidence, an access failure is only an observation—not proof that protection was enforced.

Test the Complete Security Model

A practical test compares two agents:

• ✓One with explicit Sites.Selected access
• ✓One using a Copilot Studio SharePoint knowledge source

Ask both agents the same questions about an agent-readable document and an agent-restricted document.

Then review the audit records to identify which identity each agent used and whether the restriction was genuinely enforced.

This step is especially important because a knowledge connector may use an access path different from the agent identity shown in Copilot Studio.

Final Takeaway

Securing enterprise AI agents requires more than adding a permission or creating a DLP policy. A complete model needs all three layers:

• ✓The gate: Identity and least-privilege access
• ✓The door: Sensitivity labels and DLP protection
• ✓The security camera: Audit and activity records

When these controls work together, organizations can adopt AI agents without giving them unrestricted access to enterprise information.

Before trusting an AI agent with your data, verify its identity, restrict its access, protect the content, and audit the outcome.